{"metadata": {"vulnerability": "CVE-2026-18143", "count": 32, "kinds": {"milestone": 4, "sighting": 19, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-07-28T18:54:42.563Z", "date_only": false, "value": "2026-07-28T18:54:42.563Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-18143", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-25T17:47:32Z", "date_only": false, "value": "2026-09-25T17:47:32.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-18143", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-09-26T06:39:44.226Z", "date_only": false, "value": "2026-09-26T06:39:44.226Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-18143", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-26T06:39:44.226Z", "date_only": false, "value": "2026-09-26T06:39:44.226Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-18143", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-26T07:17:02Z", "date_only": false, "value": "2026-09-26T07:17:02Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-F78J-XWC8-GQ3Q", "record": "GHSA-F78J-XWC8-GQ3Q", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-26T07:17:02.017Z", "date_only": false, "value": "2026-09-26T07:17:02.017", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-18143", "record": "FKIE_CVE-2026-18143", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-26T07:21:43.652Z", "date_only": false, "value": "2026-09-26T07:21:43.652610Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3mwfqrnvqe42n", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "a31a163c-d138-4fdc-9a1d-34f74a555f92", "content": "\ud83d\udea8 BREAKING\n\nA stranger with no login can upload a PHP file and run it on your WooCommerce store.\n\nRequest a Quote for WooCommerce (through 2.9.2) has a critical file-upload flaw, and there is no patch yet.\n\nDisable the popup quote form now. (CVE-2026-18143)", "url": "https://bsky.app/profile/suriq.io/post/3mwfqrnvqe42n"}, {"timestamp": "2026-09-26T07:30:22.679Z", "date_only": false, "value": "2026-09-26T07:30:22.679856Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfrb4pkm22d", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "2d0e93a9-4f28-447d-b1d2-c9cdfdff226d", "content": "\ud83d\udd34 CVE-2026-18143 - Critical (9.8)\n\nThe Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload i...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-18143/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfrb4pkm22d"}, {"timestamp": "2026-09-26T07:30:23.672Z", "date_only": false, "value": "2026-09-26T07:30:23.672156Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117336167086081177", "record": "cve-2026-18143", "field": "creation_timestamp", "uuid": "f2b78bd9-d765-4625-8c60-da30e53986b9", "content": "CVE-2026-18143 | CRITICAL unrestricted file upload in Addify Request a Quote for WooCommerce (<=2.9.2). Unauth attackers can achieve RCE. Disable public quote rule/multi-page popup or restrict uploads. https://radar.offseq.com/threat/cve-2026-18143-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-addify-request-a-quote-for-1e9c37910ddb8c12 #OffSeq #WordPress #Vuln #RCE", "url": "https://infosec.exchange/users/offseq/statuses/117336167086081177"}, {"timestamp": "2026-09-26T07:30:25.758Z", "date_only": false, "value": "2026-09-26T07:30:25.758462Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwfrba2qas2q", "record": "cve-2026-18143", "field": "creation_timestamp", "uuid": "99b7347a-fdc9-43e4-9b6a-33af2313624d", "content": "Addify Request a Quote for WooCommerce (<=2.9.2) hit by CRITICAL CVE-2026-18143: unrestricted file upload enables unauth RCE. Disable public quote/multi-page popup or limit uploads. https://radar.offseq.com/threat/cve-2026-18143-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-addify-re...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mwfrba2qas2q"}, {"timestamp": "2026-09-26T08:07:06.242Z", "date_only": false, "value": "2026-09-26T08:07:06.242100Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwftcstqhi24", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "6d2f6b03-fccc-4079-ba45-0787c23df6e2", "content": "\ud83d\udea8 CVE-2026-18143 \u2014 CVSS 9.8 CRITICAL\n\nThe Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all vers...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-18143\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mwftcstqhi24"}, {"timestamp": "2026-09-26T09:00:09Z", "date_only": false, "value": "2026-09-26T09:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103410", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "1a39ce2f-137f-4782-b24f-3f681ccdc0d2", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18143\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 08:00:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated arbitrary file upload in Addify Request a Quote for WooCommerce \u2264 2.9.2 via public AJAX afrfq_submit_quote_via_popup \u2014 unsafe move_uploaded_file() with attacker-controlled .php filenames into web-accessible RFQ temp storage (popup quote flow required). CVSS 9.8. Python check/exploit PoC \u2192 pocbit.org/pocs/cve-2026-18143\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103410", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-26T09:00:09Z", "date_only": false, "value": "2026-09-26T09:00:09.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103410", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "25bd2c4c-5aed-48a4-b0b1-48d24c26c07a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18143\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 08:00:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated arbitrary file upload in Addify Request a Quote for WooCommerce \u2264 2.9.2 via public AJAX afrfq_submit_quote_via_popup \u2014 unsafe move_uploaded_file() with attacker-controlled .php filenames into web-accessible RFQ temp storage (popup quote flow required). CVSS 9.8. Python check/exploit PoC \u2192 pocbit.org/pocs/cve-2026-18143\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103410"}, {"timestamp": "2026-09-26T09:30:19Z", "date_only": false, "value": "2026-09-26T09:30:19Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F78J-XWC8-GQ3Q", "record": "GHSA-F78J-XWC8-GQ3Q", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-26T09:30:19Z", "date_only": false, "value": "2026-09-26T09:30:19Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F78J-XWC8-GQ3Q", "record": "GHSA-F78J-XWC8-GQ3Q", "field": "modified"}, {"timestamp": "2026-09-26T11:19:52.981Z", "date_only": false, "value": "2026-09-26T11:19:52.981830Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mwg63jwtto2y", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "aaaec915-9f73-4a45-8d43-797131f3caa3", "content": "WordPress\u30d7\u30e9\u30b0\u30a4\u30f3\u300cRequest a Quote for WooCommerce\u300d\u306e\u5168\u30d0\u30fc\u30b8\u30e7\u30f3\uff082.9.2\u307e\u3067\uff09\u3067\u3001\u30d5\u30a1\u30a4\u30eb\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u306e\u8106\u5f31\u6027\u306b\u3088\u308a\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u653b\u6483\u8005\u304cPHP\u30d5\u2026\nCVE-2026-18143 CVSS 9.8 | CRITICAL", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mwg63jwtto2y"}, {"timestamp": "2026-09-26T21:20:05.354Z", "date_only": false, "value": "2026-09-26T21:20:05.354064Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwh7msd5pa2o", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "9425bdb4-bcf8-4186-8dfa-aff237fd5c8b", "content": "CVE-2026-18143 - request a quote for woocommerce\nThe Request a Quote for WooCommerce plugin for WordPress (versions up to 2.9.2) lets people who are not logged in upload files through a popup form. Because the upload\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#addify #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mwh7msd5pa2o"}, {"timestamp": "2026-09-26T22:43:49.202Z", "date_only": false, "value": "2026-09-26T22:43:49.202450Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-18143", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-26T22:43:49.202Z", "date_only": false, "value": "2026-09-26T22:43:49.202450Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-18143", "record": "FKIE_CVE-2026-18143", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-26T22:51:17.345Z", "date_only": false, "value": "2026-09-26T22:51:17.345Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-18143", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-26T22:51:17.345Z", "date_only": false, "value": "2026-09-26T22:51:17.345Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-18143", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-27T00:20:33.958Z", "date_only": false, "value": "2026-09-27T00:20:33.958037Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mwhjpizzjj2v", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "b2dc586d-c574-427a-adfc-28cd4beaf233", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-18143: The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including\u2026\nCVSS 9.8 \u00b7 EPSS 0.4%\nhttps://beta.vulnsea.com/cve/CVE-2026-18143\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3mwhjpizzjj2v"}, {"timestamp": "2026-09-27T11:00:14.265Z", "date_only": false, "value": "2026-09-27T11:00:14.265863Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mwinhcvh7f2a", "record": "cve-2026-18143", "field": "creation_timestamp", "uuid": "99ed7fea-86be-4310-857e-7ed9ba10fc09", "content": "WooCommerce Request a Quote plugin \u22642.9.2: CVE-2026-18143, CVSS 9.8 arbitrary file upload. Patch to 2.9.3 now\u2026 https://0daynews.com/articles/2026-09-27-woocommerce-request-quote-cve-2026-18143-file-upload/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-3743", "url": "https://bsky.app/profile/0daynews.bsky.social/post/3mwinhcvh7f2a"}, {"timestamp": "2026-09-28T15:16:04.793Z", "date_only": false, "value": "2026-09-28T15:16:04.793", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-18143", "record": "FKIE_CVE-2026-18143", "field": "lastModified"}, {"timestamp": "2026-09-29T09:00:05Z", "date_only": false, "value": "2026-09-29T09:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/xYupCOiSFluxoRtEIIOqRNM-7ebwlq042DjZCiLHA-8Nahg", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "cc238eb4-d9e7-4aa9-b9e6-e2b63469d22e", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-29T09:00:05Z", "date_only": false, "value": "2026-09-29T09:00:05.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/xYupCOiSFluxoRtEIIOqRNM-7ebwlq042DjZCiLHA-8Nahg", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "5b8ea8ae-98d4-4136-964c-bbf1841d7239"}, {"timestamp": "2026-09-30T05:00:07Z", "date_only": false, "value": "2026-09-30T05:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103828", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "39f50a0a-6a43-4ab8-853c-4e85abdf878c", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18143\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ghannyxploit404\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-30 04:40:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nsingle PoC for CVE-2026-18143 Unauth AFU (Arbitrary File Upload)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103828", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-30T11:00:16Z", "date_only": false, "value": "2026-09-30T11:00:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/exVAhrP1-AAubpKYl6FaYOVvUMj-EWVwuiZhrcEaPgn_YiI", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "4cfaf1ea-fb82-4d1c-b8b3-72fedff829ee", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-30T11:00:16Z", "date_only": false, "value": "2026-09-30T11:00:16.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/exVAhrP1-AAubpKYl6FaYOVvUMj-EWVwuiZhrcEaPgn_YiI", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "f9d3e710-2fcb-41df-935d-628632be45f2"}, {"timestamp": "2026-09-30T15:00:07Z", "date_only": false, "value": "2026-09-30T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/hVzfzjG8HX7XkYPzE6lD345G0zvEviIj5TgMsHDl6OFau3k", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "b07a81fa-ece9-4e2a-b43c-8cf90e9f0fd2", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-30T15:00:07Z", "date_only": false, "value": "2026-09-30T15:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/hVzfzjG8HX7XkYPzE6lD345G0zvEviIj5TgMsHDl6OFau3k", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "3da9bc1d-74ab-4d61-80ae-5f998c24231c"}, {"timestamp": "2026-10-15T02:57:31Z", "date_only": false, "value": "2026-10-15T02:57:31.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-18143.yaml", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "9f18ff7e-c5e8-4fd6-b38a-2faba1a0e5ac", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-18143.yaml"}], "metrics": {"as_of": "2026-10-29T07:48:03.836Z", "anchors": {"origin": {"timestamp": "2026-09-26T06:39:44.226Z", "date_only": false, "value": "2026-09-26T06:39:44.226Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-18143", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-09-26T06:39:44.226Z", "date_only": false, "value": "2026-09-26T06:39:44.226Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-18143", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-09-26T09:00:09Z", "date_only": false, "value": "2026-09-26T09:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103410", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "1a39ce2f-137f-4782-b24f-3f681ccdc0d2", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18143\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 08:00:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated arbitrary file upload in Addify Request a Quote for WooCommerce \u2264 2.9.2 via public AJAX afrfq_submit_quote_via_popup \u2014 unsafe move_uploaded_file() with attacker-controlled .php filenames into web-accessible RFQ temp storage (popup quote flow required). CVSS 9.8. Python check/exploit PoC \u2192 pocbit.org/pocs/cve-2026-18143\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103410", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 8424.774, "hours": 2.3402149999999997, "days": 0.09750895833333333, "min_seconds": 8424.774, "max_seconds": 8424.774, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-26T06:39:44.226Z", "date_only": false, "value": "2026-09-26T06:39:44.226Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-18143", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-09-26T09:00:09Z", "date_only": false, "value": "2026-09-26T09:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103410", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "1a39ce2f-137f-4782-b24f-3f681ccdc0d2", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18143\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 08:00:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated arbitrary file upload in Addify Request a Quote for WooCommerce \u2264 2.9.2 via public AJAX afrfq_submit_quote_via_popup \u2014 unsafe move_uploaded_file() with attacker-controlled .php filenames into web-accessible RFQ temp storage (popup quote flow required). CVSS 9.8. Python check/exploit PoC \u2192 pocbit.org/pocs/cve-2026-18143\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103410", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 2855299.61092, "hours": 793.1387808111111, "days": 33.047449200462964, "min_seconds": 2855299.61092, "max_seconds": 2855299.61092, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-26T06:39:44.226Z", "date_only": false, "value": "2026-09-26T06:39:44.226Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-18143", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T07:48:03.836Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 2846874.83692, "hours": 790.7985658111112, "days": 32.94994024212963, "min_seconds": 2846874.83692, "max_seconds": 2846874.83692, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-26T09:00:09Z", "date_only": false, "value": "2026-09-26T09:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103410", "record": "CVE-2026-18143", "field": "creation_timestamp", "uuid": "1a39ce2f-137f-4782-b24f-3f681ccdc0d2", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18143\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 08:00:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated arbitrary file upload in Addify Request a Quote for WooCommerce \u2264 2.9.2 via public AJAX afrfq_submit_quote_via_popup \u2014 unsafe move_uploaded_file() with attacker-controlled .php filenames into web-accessible RFQ temp storage (popup quote flow required). CVSS 9.8. Python check/exploit PoC \u2192 pocbit.org/pocs/cve-2026-18143\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103410", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-29T07:48:03.836Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}